UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 4648 - A logon was attempted using explicit credentials / Failure events for 4648 / Latest Posts

RE: Failure events for 4648

RandyFranklinSmith — Wed, 08 Sep 2010 05:20:38 GMT

We are looking for a failed version of this event. Your example is a succesful

RE: Failure events for 4648

SecShield — Tue, 07 Sep 2010 21:03:55 GMT

Source: Microsoft-Windows-Security-Auditing
Date: 8/9/2010 6:37:13 PM
Event ID: 4648
Task Category: Logon
Level: Information
Keywords: Audit Success
User: N/A
Computer: Computer_name
Description:
A logon was attempted using explicit credentials.

Subject:
Security ID: SYSTEM
Account Name: Computer_Name$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x2e8
Process Name: C:\Windows\System32\services.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.

[b]
This is a copy of Security Event Log from my laptop (I changed only the original name of computer to Computer_Name, and Account Name which appears as computer name too to Computer_Name). Can you post an explanations to Event ID:4648.[/b]

RE: Failure events for 4648

RandyFranklinSmith — Wed, 17 Feb 2010 09:08:42 GMT

Look for failed 4625 - My testing indicates that Windows does not log failed 4668. If anyone produces one please send me a copy of the event and the steps to recreate.

RE: Failure events for 4648

mdstevens — Tue, 16 Feb 2010 10:28:14 GMT

Sorry make that 4648.

Failure events for 4648

mdstevens — Tue, 16 Feb 2010 10:27:11 GMT

Hi I am looking for the failure events for 4638 events (RunAs) any ideas where this lives in 2008?

Thanks

Mark